CVE-2026-82324: GIMP IFF/ILBM Plugin DOS Vulnerability

CVE-2026-82324 Overview

CVE-2026-82324 is a heap out-of-bounds read vulnerability in the file-iff (IFF/ILBM) plugin shipped with GIMP. The plugin fails to validate the HAM row size and mishandles cases where the number of color planes (nPlanes) equals zero. This produces a row size mismatch that bypasses existing memory bounds checks when parsing a crafted IFF/ILBM image. Successful exploitation can crash the application or disclose limited heap memory contents to an attacker who convinces a user to open a malicious file. The issue affects GIMP and downstream distributions including Red Hat Enterprise Linux 6, 7, 8, and 9. The weakness is tracked under CWE-125.

Critical Impact
A crafted IFF/ILBM file processed by GIMP can trigger heap out-of-bounds reads, leading to denial of service or limited disclosure of adjacent heap memory.

Affected Products

GIMP (file-iff / ILBM plugin)
Red Hat Enterprise Linux 6, 7, 8, and 9
Any Linux distribution packaging the vulnerable GIMP file-iff plugin

Discovery Timeline

2026-08-28 - CVE-2026-82324 published to the National Vulnerability Database
2026-08-31 - Record last modified in NVD

Technical Details for CVE-2026-82324

Vulnerability Analysis

The defect lives in GIMP's file-iff plugin, which parses Interchange File Format (IFF) images including the Amiga ILBM (InterLeaved BitMap) variant. ILBM images encode pixel data as a series of bitplanes. Hold-And-Modify (HAM) is a specialized ILBM mode that reconstructs pixel color by modifying components of neighboring pixels. The parser computes per-row byte counts from the nPlanes field in the BMHD chunk. When nPlanes is zero, the computed row size collapses to zero while the underlying buffer still advances, breaking the invariant that bounds checks depend on. Reads then walk past the end of the allocated row buffer into unrelated heap memory. Because the read is unaligned to allocation boundaries, contents adjacent to the row buffer can leak into decoded pixel data and, in some cases, cause the process to abort.

Root Cause

The root cause is missing input validation of the nPlanes field and the derived HAM row size before those values are used in pointer arithmetic and bounds comparisons. The plugin trusts attacker-controlled header data instead of rejecting malformed geometry.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a crafted .iff or .ilbm file through email, a web download, or shared storage. When the user opens the file in GIMP, the vulnerable plugin parses the header and triggers the out-of-bounds read. No elevated privileges are required, and no network path is exposed by the plugin itself.

// No verified public exploit code is available for CVE-2026-82324.
// See the Red Hat advisory and GNOME GitLab work item for technical details.

Detection Methods for CVE-2026-82324

Indicators of Compromise

Unexpected GIMP process crashes or SIGSEGV / SIGABRT signals immediately following the opening of an IFF or ILBM file.
Presence of .iff, .ilbm, .lbm, or .ham files from untrusted sources in user download or mail attachment directories.
AddressSanitizer or Valgrind reports of heap-buffer-overflow reads originating in the file-iff plugin during image import.

Detection Strategies

Deploy endpoint telemetry that flags abnormal termination of the gimp process correlated with recent file open events.
Inspect IFF/ILBM headers at email and web gateways, blocking files whose BMHD chunk declares nPlanes = 0 or inconsistent HAM geometry.
Enable core dump collection on workstations that run GIMP so crashes can be triaged for exploitation attempts.

Monitoring Recommendations

Track installed GIMP package versions across the fleet and alert on hosts running versions predating the vendor fix.
Log file-open activity for GIMP and correlate it with subsequent process exits within a short time window.
Monitor Red Hat and GNOME advisories for updated fixed-version metadata tied to CVE-2026-82324.

How to Mitigate CVE-2026-82324

Immediate Actions Required

Apply vendor updates for GIMP as soon as patched packages become available from your Linux distribution.
Instruct users to avoid opening .iff, .ilbm, or .lbm files received from untrusted sources until patches are deployed.
Restrict GIMP execution on shared or high-value workstations to accounts that do not process external image submissions.

Patch Information

Refer to the Red Hat CVE-2026-82324 Advisory, Red Hat Bug Report #2525609, and the GNOME GIMP Work Item #16584 for tracking the upstream fix and downstream package availability. Update GIMP through your distribution's package manager once fixed builds are released.

Workarounds

Remove or disable the file-iff plugin from the GIMP plug-ins directory if IFF/ILBM support is not required in your environment.
Use file-type allowlists at email and web filtering layers to block delivery of IFF-family image files.
Open untrusted image files inside a sandboxed environment such as a disposable container or virtual machine.

bash

# Example: remove the vulnerable plugin binary on a Linux system
# Adjust the path to match your distribution and GIMP version
sudo rm /usr/lib64/gimp/2.0/plug-ins/file-iff/file-iff